BMW Gen5 TPMS support

[petrjac]

Hi,

I'm trying to decode BMW Gen5 TPMS sensors.

I recorded several samples using Airspy R2 SDR - https://github.com/merbanan/rtl_433_tests/pull/463/files .

I was able to read raw data using URH and resolved CRC-8 as poly=0x2f init=0x40:

0xfff20323e136a14a3e016b686b
0xfff20323e136a1343d017468cf
0xfff20323e137a81b3e005a68dc

However with rtl_433 I'm getting different results:

❯ rtl_433 -r tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16 -R 0 -X 'n=tpms_bmw,m=FSK_MC_ZEROBIT,s=25,l=25,r=100' -Y minmax
rtl_433 version 23.11-19-g83afc7b4 branch master at 202312252023 inputs file rtl_tcp RTL-SDR SoapySDR with TLS
Disabling all device decoders.
[Input] Test mode active. Reading samples from file: tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : @0.002138s
model     : tpms_bmw     count     : 1             num_rows  : 1             rows      : 
len       : 104          data      : 00020323e136a14a3e016b686b
codes     : {104}00020323e136a14a3e016b686b

Binary data started with 0x000 instead of 0xfff.

Could please someone help with verifying data before proceeding?

[zuckschwerdt]

It's basically the same. MC can't reliably discern the timing of the short transitions until the first long one.

[petrjac]

Does it make sense then calculated CRC for stripped data:

❯ bin/i386-linux/reveng -w 8 -s 0323e136a14a3e016b686b 0323e136a1343d017468cf 0323e137a81b3e005a68dc 0323e136a1403e016f6830 0323e136a1343d017468cf
width=8  poly=0x2f  init=0xaa  refin=false  refout=false  xorout=0x00  check=0x2a  residue=0x00  name=(none)

?

[petrjac]

With bitbench I am able to guess:

• sensor ID
• pressure [bar]
• nominal (target?) pressure [bar]
• temperate [°C]
• CRC

Should I investigate more or could I try to prepare decoder?

[zuckschwerdt]

0xaa as init seems much nicer than 0x40. And we usually expect a preamble. The resulting raw aaaa aa59 preabmle does not look plausible (at least we have not seen such before). We can't be sure until the data fields are decoded.

[zuckschwerdt]

Looks good already. You might be missing the alarm flags like rapid deflate, low battery and diagnostics as spinning, triggered, ...

[petrjac]

I tried to guess couple more columns - bitbench, but some of them are hard for me to verify.

I'm using diagnostic tool as reference:

What should be the next steps?

[zuckschwerdt]

PR a decoder if you like :) Look into the other TPMS decoders and copy one that looks clean and simple.

[ProfBoc75]

Binary data started with 0x000 instead of 0xfff.

Could please someone help with verifying data before proceeding?

Hi @petrjac : try to increase the pulse to 27 instead of 25 and you will get the 0xfff, if you reduce to 24 you will get the 0x000

[zuckschwerdt]

increase the pulse to 27 instead of 25 and you will get the 0xfff, if you reduce to 24 you will get the 0x000

That's unexpected. For MC we don't need an exact timing and the slicer should always match. Does this slight change somehow match/ignore the first "bit"? That would change the assumption about 000 vs fff.

[petrjac]

• s=25 → {104}00020323e136a14a3e016b686b
• s=26 → {104}40020323e136a14a3e016b686b
• s=27 → {104}7ff20323e136a14a3e016b686b

When trying with tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16

 ❯ rtl_433 -r tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16 -R 0 -X 'n=tpms_bmw,m=FSK_MC_ZEROBIT,s=27,l=27,r=100' -Y minmax
rtl_433 version 23.11-19-g83afc7b4 branch master at 202312252023 inputs file rtl_tcp RTL-SDR SoapySDR with TLS
Disabling all device decoders.
[Input] Test mode active. Reading samples from file: tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : @0.002138s
model     : tpms_bmw     count     : 1             num_rows  : 1             rows      : 
len       : 104          data      : 7ff20323e136a14a3e016b686b
codes     : {104}7ff20323e136a14a3e016b686b

[zuckschwerdt]

Thanks for confirming! That does not seem right, we need to look into that. I can try to rewrite the MC slicer with that nice example we have here.
(Idea: on leading short pulses push to a counter and only add the bits when the position later is confirmed.)

[ProfBoc75]

Hi @zuckschwerdt , @petrjac :

FYI, I drafted a decoder, and started listening to the cars passing on my street.

Sounds like the bitbench is not exactly as expected, I need to consolidate my findings in a table and back here soon.

About the rf decode part, I'm using FSK_PCM, s=l=25, r=100, then looking for preamble = 0xaa59 then MC decode + Invert.

Data Layout :

Brand / Manuf   : 8h, I found at least 3 values : 0x03 (=3),  0x23 (=35) and 0x80 (=128)
Sensor ID       : 32h,  4 byte Sensor ID
Pressure        : 8h, purpose to be confirmed, formula not guess yet
Temp            : 8h, Temp sound to be OK , `Temperature_C - 50`   (with this formula temp - 50 , I have some around 12 or 13°C matching my local temp and other more around 17 to 19°C, may be cars coming from garage ?)
Warn / Tags 1   : 8h, purpose to be confirmed, some incremental values here
SEQ_ID / Tags 2 : 8h, purpose to be confirmed,
Target Pressure : 8h, purpose to be confirmed, formula not guess yet, could be a third tag.
CRC             : 8h, CRC-8 poli 0x2f  , init 0xaa

The pressure values, I'm not able yet to find a simple formula to convert value into kPa or PSI , I need more samples for that.
For WARN and SEQ_ID do not match the purpose, as WARN may also increase too and I don't have the valves, so I can't confirm. Theses tags are related to the tire/flat type, its size, programmed by the RDC Tool. And we should have here the battery, fast deflating alert too.

Notice that the captures from Airspy @ 10MHz are not readable by rtl_433 (no error, but only partial value), only the 2.5MHz give expected results with -Y minmax.

[petrjac]

@ProfBoc75 you are faster than me :), I was planning to write decoder on the weekend.

I'l be happy to help you at least with my findings:

• Brand / Manuf - considering it as unknown

• Pressure - could by DEC * 0,0245 to get pressure in bars

  • Ref. press [bar] is value from diagnostic software

  HEX	DEC	Ref. press [bar]	round(DEC * 0.0245, 2)
  2F	47	1.15	1.15
  2A	42	1,03	1.03
  26	38	0.93	0.93
  1B	27	0.65	0.66

• Temp - could be DEC - 52, would need more data

  HEX	DEC	Ref. temp [°C]	DEC - 52
  3E	62	10	10

• Warn / Tags - unknown

• SEQ_ID / Tags 2 - this could be some message id increment by one. I saw always 3 exactly same messages with same SEQ_ID followed by next 3 messages with SEQ_ID incremented by 0x01.

• Target Pressure - unknown, but interestingly:
  0x68 = 104, ROUND(104 * 0.0245, 2) = 2.55 is similar to 2.53 reported by diagnostic software

• CRC - should be OK

[ProfBoc75]

I noticed also that , depends on the first byte , Manuf/Brand, the coding is not the same, And for 0x80 (128) sounds to be Continental model.

There is another discussion here where the data packet is also 11 byte
Starting with a Brand ID (0x80) then the Sensor ID (4 byte) , 01 or 02, then temp, pressure and or tags information then exactly the same CRC-8 poli 0x2F, init 0xaa.

The RF part is not the same (not Manchester coded), but the data formatting sounds to be very close, just not information in the same order as Brand HUF (0x03).

if we guess all the formula and with DATA_COND, we may be able to handle these 2 Brands.

Edit : looking at the RDC Production information guide (page 20, 3. Operation picture) , the third brand could be "Schrader" trademark of "Sensata", and I notice that from my street :

2x xx xx xx = HUF Sensor ID , brand = 0x03 (3)
3x xx xx xx = Continental ID, brand = 0x80 (128)
5x xx xx xx = Schrader/Sensata ID , brand = 0x23 (35)

[ProfBoc75]

FYI, it takes time to collect metrics and to deep dive, since I'm trying to manage the 3 brands in the same decoder, and not so much cars in my one way street.

At least the brand 0x03 / Huf Gen 5 is ok for me without the flags decoding which require some work, we don't know which bit is related to battery, fast deflating and so on ...

[petrjac]

In diagnostic sw data I have found more manufacturer for TPMS:

• Autonet
• HUF
• Continental
• TRW
• Sensata
• Unknown manufacturer

However I cannot be sure that list is correct/complete.

On the weekend I'll try to receive signals from HUF sensors to confirm temperate, pressure and maybe also alarm tags.

Interestingly the RDCi gen 5 sensors should also send tire size ...

[ProfBoc75]

Hi, I collected some data from the street :

I kept the original order to get the sequence number increasing if any.
Notice a new detect Brand 0x88, only one message captured.
All of them are similar for the 4 first data: Brand, ID, Pressure and Temp
The 3 last bytes (except CRC) have not the same behavior, some are fixed, other are variable, but they reflect the reality from the street.
So I tried to guess the data layout :

_______________________________________________________________________________________________________________________
|                               |                                              |                    | Decimal Values  |
| Msg                           | Data layout                                  | Comments           |  B7 |  B8 |  B9 |
| BB IIIIIIII PP TT F0 F1 F2 CC |                                              |                    |  F0 |  F1 |  F2 |
| 03 23b3dd0f 6d 43 57 71 e8 ae | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  87 | 113 | 232 |
| 03 23b3dd0f 6d 43 6b 71 e8 e9 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 107 | 113 | 232 |
| 80 33ca4f80 6c 3e 31 0e 09 74 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |  14 |   9 |
| 80 33ca4f80 6c 3e 31 0e 0a 05 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  49 |  14 |  10 |
| 80 33ca4f80 6c 3e 31 0e 0b 2a | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  49 |  14 |  11 |
| 80 33ca5530 6c 3e 32 1c 0e 23 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  50 |  28 |  14 |
| 80 33ca5530 6c 3e 32 1c 0f 0c | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  50 |  28 |  15 |
| 80 33ca63b0 6a 3f 31 08 07 ce | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |   8 |   7 |
| 23 501a8308 63 44 63 67 c5 ab | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  99 | 103 | 197 |
| 23 5258ba4b 6c 45 49 71 e1 c3 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  73 | 113 | 225 |
| 23 5258ba4b 6c 45 5e 71 e1 09 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +21 |  94 | 113 | 225 |
| 23 5258ba4b 6c 45 83 71 e1 93 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +37 | 131 | 113 | 225 |
| 23 5258c379 6f 45 70 71 e1 59 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 112 | 113 | 225 |
| 23 5258c379 6f 45 84 71 e1 52 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 132 | 113 | 225 |
| 80 30b30da4 5d 3f 6a 21 09 2c | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 106 |  33 |   9 |
| 80 30b30da4 5d 3f 6a 21 0a 5d | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 106 |  33 |  10 |
| 80 30b30da4 5d 3f 6a 21 0b 72 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 106 |  33 |  11 |
| 80 33ca4f80 70 44 31 29 0e e9 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |  41 |  14 |
| 80 33ca4f80 70 44 31 29 0f c6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  49 |  41 |  15 |
| 80 33ca63b0 6a 41 31 16 0e a7 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |  22 |  14 |
| 80 30b30da4 5d 3d 6a 15 0a a2 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 106 |  21 |  10 |
| 80 30b30dbf 69 3f 6a 0a 05 63 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 106 |  10 |   5 |
| 80 385135e3 5b 42 21 0d 09 50 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  33 |  13 |   9 |
| 80 385135e3 5b 42 21 0d 0a 21 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  33 |  13 |  10 |
| 80 385135e3 5b 42 21 0d 0b 0e | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  33 |  13 |  11 |
| 80 385135de 5b 41 1f 0d 09 74 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  31 |  13 |   9 |
| 80 385135de 5b 41 1f 0d 0a 05 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  31 |  13 |  10 |
| 80 385135de 5b 41 1f 0d 0b 2a | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  31 |  13 |  11 |
| 80 35ac8aa2 5e 3e 38 21 0d ea | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  56 |  33 |  13 |
| 80 35ac8aa2 5e 3e 38 21 0e 9b | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  56 |  33 |  14 |
| 80 35ac8aa2 5e 3e 38 21 0f b4 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  56 |  33 |  15 |
| 23 235d2558 63 3e 51 78 e9 f9 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  81 | 120 | 233 |
| 23 235d2558 63 3e 65 78 e9 ce | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 101 | 120 | 233 |
| 23 235d2558 63 3e 79 78 e9 66 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 121 | 120 | 233 |
| 80 3edad6e7 71 0e 18 12 09 61 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  24 |  18 |   9 |
| 80 3edad6e7 71 0e 18 12 0b 3f | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +2  |  24 |  18 |  11 |
| 80 3ec301f1 74 10 18 0d 0a 44 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  24 |  13 |  10 |
| 80 3ec301f1 74 10 18 0d 0b 6b | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  24 |  13 |  11 |
| 80 3edad6e9 73 12 18 0f 0a 17 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  24 |  15 |  10 |
| 80 3edad6e9 73 12 18 0f 0b 38 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  24 |  15 |  11 |
| 80 3edad6af 73 13 18 0c 09 2d | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  24 |  12 |   9 |
| 80 3edad6af 73 13 18 0c 0a 5c | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  24 |  12 |  10 |
| 80 3b1446f7 63 0b 08 12 0a a6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |   8 |  18 |  10 |
| 80 3b1446f7 63 0b 08 12 0b 89 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |   8 |  18 |  11 |
| 80 3b2306b1 55 0d 09 16 0d 8d | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |   9 |  22 |  13 |
| 03 235d2558 63 3e 97 78 e9 ae | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 151 | 120 | 233 |
| 03 235d2566 6b 3e a4 7b ea 5e | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 164 | 123 | 234 |
| 03 235d2566 6b 3e b8 7b ea f6 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 184 | 123 | 234 |
| 88 22a555bd 64 42 e6 04 c5 8c | Brand ID Pressure Temp ????  ????   ???? CRC | NEW Brand          | 230 |   4 | 197 | 
| 03 20325efb 6b 41 55 7a e1 7e | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  85 | 122 | 225 |
| 03 20325efb 6b 41 69 7a e1 39 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 105 | 122 | 225 |
| 03 20325efb 6b 41 7d 7a e1 e1 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 125 | 122 | 225 |
| 23 20325711 60 3f 77 62 e1 d9 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 119 |  98 | 225 |
| 03 20325ed5 5f 3f 54 79 e1 f3 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  84 | 121 | 225 |
| 03 20325ed5 5f 3f 7c 79 e1 6c | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +40 | 124 | 121 | 225 |
| 80 323275d4 60 41 39 21 0d 15 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  57 |  33 |  13 |
| 80 323275d4 60 41 39 21 0e 64 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  57 |  33 |  14 |
| 80 323275d4 60 41 39 21 0f 4b | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  57 |  33 |  15 |
| 23 22dacf9c 5b 40 6b 67 e9 46 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 107 | 103 | 233 |
| 03 22daced9 60 41 44 62 e9 b0 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  68 |  98 | 233 |
| 03 22daced9 60 41 58 62 e9 18 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 |  88 |  98 | 233 |
| 03 22daced9 60 41 6c 62 e9 2f | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 108 |  98 | 233 |
| 03 22dad000 62 41 58 7e e9 f7 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  88 | 126 | 233 |
| 03 22dad000 62 41 6c 7e e9 c0 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 108 | 126 | 233 |
| 03 22dad000 62 41 80 7e e9 5b | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 128 | 126 | 233 |
| 80 35b9e4b7 62 3d 38 1e 09 d0 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  56 |  30 |   9 |
| 80 35b9e4b7 62 3d 38 1e 0a a1 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  56 |  30 |  10 |
| 80 35b9e4b7 62 3d 38 1e 0b 8e | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  56 |  30 |  11 |
| 80 359a9603 5d 3d 38 21 0d cd | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  56 |  33 |  13 |
| 80 33ca5530 6c 3e 32 1a 09 c6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  50 |  26 |   9 |
| 80 33ca5530 6c 3e 32 1a 0a b7 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  50 |  26 |  10 |
| 80 33ca5530 6c 3e 32 1a 0b 98 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  50 |  26 |  11 |
| 80 302b6733 56 3e 2e 27 09 29 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  46 |  39 |   9 |
| 80 33ca4f80 74 4b 31 32 0e f6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |  50 |  14 |
| 80 30b30dbf 6b 42 69 19 09 b7 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 105 |  25 |   9 |
| 80 30b30dbf 6b 42 69 19 0a c6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 105 |  25 |  10 |
| 80 30b30dbf 6b 42 69 19 0b e9 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 105 |  25 |  11 |
| 03 20298428 5b 40 9b 74 e0 09 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 155 | 116 | 224 |
| 03 20298428 5b 40 af 74 e0 3e | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 175 | 116 | 224 |
| 03 20298428 5b 40 c3 74 e0 68 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 195 | 116 | 224 |
| 80 321ee91b 6b 44 73 24 0a fe | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 115 |  36 |  10 |
| 80 321ee74d 6c 43 73 2e 09 8d | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 115 |  46 |   9 |
| 80 321ee74d 6c 43 73 2e 0a fc | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 115 |  46 |  10 |
| 80 321ee74d 6c 43 73 2e 0b d3 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 115 |  46 |  11 |
| 80 339f2707 6a 3d 30 3a 09 16 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  48 |  58 |   9 |
| 80 339dd753 78 3e 30 45 09 c6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  48 |  69 |   9 |
| 80 339dd753 78 3e 30 45 0a b7 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  48 |  69 |  10 |
| 80 339dd753 78 3e 30 45 0b 98 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  48 |  69 |  11 |
| 80 339ee6b8 68 3d 30 12 0d f6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  48 |  18 |  13 |
| 80 339ee6b8 68 3d 30 12 0e 87 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  48 |  18 |  14 |
| 80 37569b5b 54 3f 5e 08 05 54 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  94 |   8 |   5 |
| 80 37569b5b 54 3f 5e 08 06 25 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  94 |   8 |   6 |
| 80 37569b5b 54 3f 5e 08 07 0a | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  94 |   8 |   7 |
| 23 53c66eda 63 45 01 6f e5 3c | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |   1 | 111 | 229 |
| 23 53c66eda 63 45 01 6f e5 3c | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous     |   1 | 111 | 229 |
| 23 53c66a43 69 49 01 6f e5 a1 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |   1 | 111 | 229 |
| 23 53c66a43 69 49 01 6f e5 a1 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous     |   1 | 111 | 229 |
| 23 235d5efa 6d 41 61 6a e9 3b | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  97 | 106 | 233 |
| 23 235d5efa 6d 41 75 6a e9 e3 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 117 | 106 | 233 |
| 23 20d4585d 6b 3e 87 79 e5 7e | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 135 | 121 | 229 |
| 23 20d52850 62 3e 79 62 e1 ae | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 121 |  98 | 225 |
| 03 23561022 5e 3f 01 74 e9 62 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |   1 | 116 | 233 |
| 03 23561022 5e 3f 01 74 e9 62 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous     |   1 | 116 | 233 |
| 03 23560f93 64 3f 65 67 e9 ee | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 101 | 103 | 233 |
| 03 23560f93 64 3f 79 67 e9 46 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 121 | 103 | 233 |
| 80 3177a541 5e 45 2c 09 06 85 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  44 |   9 |   6 |

[petrjac]

Hi,
I collected some signal and have some notes/questions:

1. Shouldn't we create separate issue for FSK_MC_ZEROBIT as mentioned in comment from @zuckschwerdt ?
2. Not all BMW gen5 signals are correctly recognized, e.g. g082_433.92M_2500k.cs16?
3. Would it be possible to somehow automatically add -Y minmax option for BMW Gen5 TPMS? I understand that this option is necessary.
4. DEC - 52 for temperature seems to be right:
   • 059 ~ 7°C
   • 060 ~ 8°C
5. Pressure reading however does not exactly match with diagnostics readings, e.g. 27 * 0,0245 = 0,66 != 0,65. Some more examples in bitbench.
6. I feel confident about SEQ_ID. I recorded many samples and the pattern is:
   • 3x same data message with same SEQ_ID → would it be possible to ignore repeated occurancy?
   • some separator? (g069_433.92M_2500k.cs16, g073_433.92M_2500k.cs16, g081_433.92M_2500k.cs16)
   • 3x same data message with same SEQ_ID + 0x01
7. Nominal pressure is not correct name for last data byte. I always recorded 0x68 but diagnostic report another values (2,48 bar, 2,45 bar, 2,53 bar).
8. I recorded some strange unknown signal, which looks similar to BMW gen5. Based on signal intensity it could be from same TPMS sensor.
   • ffe40647c282de9a76009ed0a6 - g080_433.92M_2500k.cs16

[zuckschwerdt]

I'm already looking into FSK_MC_ZEROBIT. It's really a problem with the bad input signal.

The minmax discriminator is default on 868 MHz where most TPMS are. It does not work too well for 433.92 MHz, usually OOK.

Try to convert some of your signals to OOK (with FSK proper name would be mark/space not on/off...) and look how noisy the resulting pulses are. rtl_433 -Y minmax -w out.ook file.cs16
We'd want to only see short and long pulses (~25 and ~50 µs). I guess the slicer is working surprisingly well given that input :)

E.g. g018_433.92M_2500k.ook

0 1
1 1
1 1
2 1
2 1
0 28
0 1
1 0
23 1
0 16
0 8
25 0
1 1
0 26
1 0
22 0
1 25
0 1
2 0
24 24
26 1
1 0
1 24
1 1
26 25
27 24
27 24
28 26
26 27
27 51
26 26
52 52
26 27
26 26
26 25
26 26
25 26
27 26
51 26
26 52
26 26
52 52
27 25
26 26
52 26
26 1
1 22
0 3
25 25
1 0
23 0
1 26
26 50
1 1
27 25
26 28
26 24
53 51
27 26
53 26
25 52
53 24
0 1
27 51
53 52
52 52
26 24
2 0
26 26
25 26
53 51
53 52
28 24
52 52
51 1
1 52
28 24
26 1
0 25
53 24
26 24
1 1
26 28
26 26
26 52
25 25
26 25
29 25
26 26
26 25
27 25
26 26
53 51
52 26
1 0
24 51
0 0
53 51
52 26
26 51
53 26
26 52
51 52
26 24
0 1
27 0
0 0
1 24
26 1
1 22
1 0
52 1
1 24
26 51
54 51
52 24
1 0
26 25

[petrjac]

OK, thank you for clarification:). This is probably due unappropriate Soapy params for Airspy R2 rtl_433 -d driver=airspy -g "LNA=8,MIX=8,VGA=11" -s 2.5M. I'm gonna experiment with different params or try sdr without 433M antenna.

[ProfBoc75]

2. Not all BMW gen5 signals are correctly recognized, e.g. g082_433.92M_2500k.cs16?

Checked with :

rtl_433 g082_433.92M_2500k.cs16 -Y minmax -R 252:vv

After MC decoded , missing 1 bit to be a valid message, expected {88} bits, 11x8 , so the message is too short and excluded.

I tried to go further and the CRC failed.

{87}fcdc1ebe90aec4ffaf9704 MC decoded
{87}0323e1416f513b0050687d Inverted, last byte is wrong and CRC failed, expected 0xfa not 0x7d

4. DEC - 52 for temperature seems to be right:

   * `059 ~ 7°C`
   * `060 ~ 8°C`
   

Good for brand 0x03, HUF, sounds like brand 0x80, Continental, the temp is DEC - 50, we need feedback from Continental valve owners to confirm that.

5. Pressure reading however does not exactly match with diagnostics readings, e.g. 27 * 0,0245 = 0,66 != 0,65. Some more examples in bitbench.

From your bitbench, the pressure is clearly = DEC * 2.5 (kPA) or DEC * 0.025 (Bar) , as most of TPMS sensors.

We saw that from other TPMS decoders , value can be coded like that : (DEC - x ) * 2.5 to get the figures.
From your sample 27 = 0.65 Bar, could be (27 - 1 ) * 0.025 = 26 * 0.025 = 0.65 Bar

6. I feel confident about SEQ_ID. I recorded many samples and the pattern is:

   * 3x same data message with same `SEQ_ID` → would it be possible to ignore repeated occurancy?
   * some separator? ([g069_433.92M_2500k.cs16](https://github.com/petrjac/rtl_433_tests/blob/1e49119a7997d3917b9e6597811a7bb3754540f6/tests/BMW_G5_TPMS/2/g069_433.92M_2500k.cs16), [g073_433.92M_2500k.cs16](https://github.com/petrjac/rtl_433_tests/blob/1e49119a7997d3917b9e6597811a7bb3754540f6/tests/BMW_G5_TPMS/2/g073_433.92M_2500k.cs16), [g081_433.92M_2500k.cs16](https://github.com/petrjac/rtl_433_tests/blob/1e49119a7997d3917b9e6597811a7bb3754540f6/tests/BMW_G5_TPMS/2/g081_433.92M_2500k.cs16))
   * 3x same data message with same `SEQ_ID + 0x01`
   

rtl_433 is receiving 3 signals, so each one are decoded.
Did you test the valves in static or rolling situations ? If you look at my table from rolling cars from my street, it's clear that the behavior is not the same, the reason why I kept the 3 flags as is to let external decoding and deep dive. TPMS sensor can report some moving / centrifugal acceleration situation, the opposite of storage state.

7. Nominal pressure is not correct name for last data byte. I always recorded 0x68 but diagnostic report another values (2,48 bar, 2,45 bar, 2,53 bar).

From the RDC tool guide, the temp should be taken into account in the normal pressure, + 0.1 bar / + 10 °C , so may be the temp is not same too ?

8. I recorded some strange unknown signal, which looks similar to BMW gen5. Based on signal intensity it could be from same TPMS sensor.

   * `ffe40647c282de9a76009ed0a6` - [g080_433.92M_2500k.cs16](https://github.com/petrjac/rtl_433_tests/blob/1e49119a7997d3917b9e6597811a7bb3754540f6/tests/BMW_G5_TPMS/2/g080_433.92M_2500k.cs16)
   

I don't understand your point, it's properly decoded with rtl_433 g080*.cs16 -Y minmax -R 252:vv

[luki343]

What bmw part number TPMS this refer?

[petrjac]

For Huf gen. 5 the P/N is 36106877937.

[petrjac]

Hello again,

I recorded several samples with BMW Gen4 sensors. The message format looks similar to Gen5 sensors and also samples collected by @ProfBoc75.
I pushed the samples here - https://github.com/merbanan/rtl_433_tests/pull/466/files

Here is bitbench with decoded data.

I was also able to compare data with official diagnostics.

Notes:

• I was not able to decode signals using rtl_433 version 23.11-51-g2d63f306, I was using Universal Radio Hacker to decode. This could be due weak signal or other issue related to my setup. Can someone please validate?
• The manufacturer 0x80 is really Continental.
• The sensor ID is interpreted as decimal (unlike gen5 sensors).
• Pressure [bar] is probably round((RAW - 1) * 0,025, 1). Displayed as rounded to 1 decimal places (gen5 showed 2 decimal places).
• Temperature is RAW - 52.
• There is no sequence ID.
• Last two bytes is also CRC-8 with poly=0x2f init=0xaa.

[ProfBoc75]

Hi @petrjac: Thanks for this feedback, can you try with this option -R 252:vv to see why it's not decoded.

I'm not able to decode your last 4 x CS16 files.

[petrjac]

@ProfBoc75 I tried this... would this be useful?

> rtl_433 -r g097_433.92M_2500k.cs16 -R 252 -vvvv
rtl_433 version 23.11-51-g2d63f306 branch master at 202402101513 inputs file rtl_tcp RTL-SDR SoapySDR with TLS
[Protocols] Registered 1 out of 252 device decoding protocols
[Input] Test mode active. Reading samples from file: g097_433.92M_2500k.cs16
[Input] Input format "CS16 IQ (2ch int16)"
[Baseband] low pass filter for 2500000 Hz at cutoff 250000 Hz, 4.0 us
Pulse data: 1 pulses
[  0] Pulse: 13804, Gap: 138041, Period: 151845
[Input] Test mode file issued 3 packets

Demodulated signal looks like this in URH:

Raw hex is aaaaaa5995555a55a5656595a96a6669656a59695556995a9a59f8 for g097, fff28030c448e756472601a3b2 after MC.

[ProfBoc75]

@petrjac:

I fact, I wanted you to run rtl_433 in live to see if you are able to get some answers, and I put verbose information in the decoder itself, like data before and after MC, so we can see where it failed and it could help me understand.

This option -R 252:vv will enable only the BMW gen5 decoder with verbose level 2. (correct your Airspy options if I'm wrong)

rtl_433 -R 252:vv -d driver=airspy -g "LNA=8,MIX=8,VGA=11" -s 2.5M -Y minmax

you may test with auto gain with -g ""

From your 4 samples, rtl_433 is not able to decode, preamble not found and raw codes are not well decoded. May be a bad airspy options (signal is overloaded/clipping, too much gain):

rtl_433 -R 252:vv *.cs16 -Y minmax

But from your last raw hex information, it looks like it should work, we can replay with rtl_433 like this:

rtl_433 -y aaaaaa5995555a55a5656595a96a6669656a59695556995a9a59f8

Edit: So for me, apart from the version/generation 4 to be taken into account, it's a signal reception problem to be tuned, playing with the gain and your LNA / MIX / VGA levels or -g "" for auto gain level. Play also with the -Y minmax option could help.

[Gucioo]

@Gucioo:

To summarize:

• Short Message = Audi Pressure Alert, sudden pressure increase or decrease, Brand ID = 0x00, send every seconde.
• Long Message , no Change, just Brand ID = 0x88 = Audi

I'm preparing an update to the decoder and will commit soon.

Yes, that's correct.

[luki343]

Does this sensor need to receive any data to start sending pressure and temp?
I'm thinking about making simple arduino board to receive data from tpms and send it via CAN to my standalone ECU to have possibility to log this data.

[ProfBoc75]

@luki343 Depends on brand model and the behavior could change between static / parked situation where the sensor is in standby mode to preserve the battery and from moving where the sensor can also send some kinetic information into one of the 3 flags.

You may be interested in this Arduino project which is already handle BMW model. You may have to cross check if they updated it with our last update with Audi model and Audi pressure alert.

[luki343]

@ProfBoc75
I know it depends on the sensor, which is why I'm asking about this particular TPMS. I thought maybe someone who sniffed this sensor found something sent from the car to the sensor.

I need to adapt some TPMS to my "race car" and send it to ECU via CANbus, so the easiest way will be to use one of the currently decoded sensors, but if it needs to receive some message from car, I'm lost.
On second car (daily, renault), I have factory TPMS (0435r) and from what I sniff myself it just sends data and nothing receive, it don't even need to be activated after mount in wheel, it activate automatically after some distance and you only need to code ID to car and thats all.
I would prefer to use this BMW sensor (continental version more precisely) instead of Renault.

I will definitely check out this project, thx

[gdt]

What's the status and plan? Is there a decoder in tree, or does something need to happen? If so, is anyone working on it?

[ProfBoc75]

What's the status and plan? Is there a decoder in tree, or does something need to happen? If so, is anyone working on it?

Hi @gdt:

• The decoder is working fine, no known issue.
• Remaining the decoding part of 3 unknown flags. Flags behave differently from one brand to another or from id range to another range.
• Based on our findings and expected information, they could contain battery level, target/nominal pressure, tire details (size, pressure...) , synectic/motion status, abnormal pressure increase/decrease....
• At my level I can help only if someone shares more samples since I don't have these TPMS sensors.
• However, rtl_433 already provides the 3 flags as 3 raw bytes which can be decoded externally.

Said that, this issue can be closed.

[gdt]

Great, thanks.

(FWIW, I am a fan of putting unknown bits in the output labeled as unknown bits/bytes, as it seems the path to improvement.)

[run-mike]

Hi!
First of all: Awesome work!
Decoder works fine on my Gen5 BMW TPMS sensors.

@luki343 :
Have you been able to determine how these sensors can be forced to communicate without request / demand from the car?
Tried it by running a few laps in the garage with a spare tire to assume movement / spinning, but that didn't yield a result.
Tried to "activate" with a 433.92 MHz remote before spinning, not good enough. Guess there has to be knowledge of the communication protocol?

Thanks in advance

Mike

[Billymazze]

You can make them go into "emergency" mode by letting all the air out down to 10psi. They'll constantly send a signal for a couple minutes or until the tire is filled back up.

[run-mike]

Thanks for your fast response!
I was actually looking for a solution to get read-outs in non-emergency mode.
I'll give ISTA a try, but don't expect much. Will have to build some sniffing device to see the request signal.
In the description there is talk of a 150kHz signal for the US / Canada model.
Not sure if that applies to the European version either.

Mike

[run-mike]

Being a noob to all this, I would like to discuss the BMW Gen5 TPMS Sensors a little further.
I guess I could even contribute to decode them further. Is that ok to do here or should I open a new thread?

Mike

[zuckschwerdt]

Unless there is an actionable todo it is preferred to continue here, where all involved people already listen :)

[run-mike]

Ok. thanks for your response!
I own two sets of original BMW alloy wheels. One set (delivered with the car) has an estimated sensor programming date of 02/2018. The winter set was produced in 08/2015; so probably programmed in 11/2015.
The read-out "Flags1" on the first set is 42 / 43. Read-out on the winter set is 15.
I contacted a specialist (works in a BMW service/repair shop) and asked him, what kind of parameter he is able to determine with the "RDC-Tool" on the F45/F46 models.
Answer:

• Battery level
• Sensor generation
• Sensor manufacturer
• Temperatur
• Sensor-ID
• Actual pressure

When ISTA is connected to my car, none of the ABL (Ablauf = sequence of events) concerning TPMS are able to be carried out. Probably due to "No error / fault code". So no activation of transmitter ...
But then again I get a different, more specific FUB (Funktionsbeschreibung = function description).
And one of those bullet points is: "Restliche Lebensdauer der Batterie" (remaining battery lifetime).
So I am quite sure, that the data "Flags1" is the remaining battery time in months. At least it fits my two wheel sets.
My other findings have to be chross-checked and confirmed yet.

Mike

[ProfBoc75]

@run-mike :

what is the brand reported for your sensors ?

As I'm also pretty sure that the behavior/ purpose of flags is different between brands. I listened to the sensors passing in my street and tracked them in an excel table. For each transmission there are 3 identical messages except for 1 flag which increments and depending on the brand it is not the same flag.

[run-mike]

@ProfBoc75 :
Reported brand is 80h = 128 = Continental / VDO on both sets.
Same behavior here. Each Sensor-ID transmits 3 consecutive messages, where only (in my cases) "Flags3" increments by 1.
On my first test-drive I used a Raspberry Pi without display to record the messages. I initialized a "pressure reset" to absolutely make sure, there are messages to record.
The values reported in "Flags2" are suspiciously close to the speed I drove (in kph). But I want to confirm that with another test-drive first.
Another point that I am working on is the "Modus Operandi".
At least "driving speed > 20/30 kph", "pressure initialization", "slow deflate" and "fast deflate" should be discernible.

I checked out the findings of @Billymazze and deflated the tire slowly. First record entry was at 31.5 kPa.
Re-inflated to the starting pressure 240 kPa. Still got transmissions. Increasing the pressure to 300 kPa. Still transmitting for at least a minute.
Next day I tried "fast deflate". Starting at about 300 kPa, first entry is at 213 kPa. Re-inflated to 340 kPa, still transmitting for 2.5 minutes. The transmitting time was 7.5 minutes.

Unfortunately I haven't found a solution for spinning the wheel in the garage > 20/30 kph. That would make it much easier ...

Mike

[run-mike]

Today I did that test-drive for confirmation of suspected speed numbers.
Sadly I have to report, that the data in "Flags2" does not represent the speed in kph. It is definitely speed dependent, but reaches 255 (decimal) at a speed of 100 kph. It is not an acceleration value either. I tried to keep the different speed-levels for as long as traffic would allow it.
Another thing that I can confirm now, is that after stopping (and ignition "off") the sensors pop up again for a last round of messages after about 4.5 minutes.

I attached the logfile so that everyone can conclude for themselves ...

Mike

218d_TPMS_testing_4.txt

[ProfBoc75]

Very interesting.

Notice also the range for the flags3.
With low speed the range is 5/6/7 , then 9/10/11, then 13/14/15.
And stopped position (flags2=1), the flags3 values are 129/130/131.
I noticed that also from the street, so into the flags3 and brand 0x80 we have sub flags linked to the speed/status of the sensor.
Only the last 2 bits are seq numbers, the 6 other bits are linked to speed or static position.

[run-mike]

Yep.
The tests on the "not-mounted-on-the-car" wheel showed always 161/162/163 as "Flags3" value.
Btw: Are we sure, that the temperature readings are correct? Todays test-drive took place under warm conditions in direct sunlight. A max temperature of 30°C seems too low for my understanding. But my infrared thermometer had a "low battery"-day, so I have to re-check that tomorrow.

I attached the old logfile for the "fast deflate" . Maybe you are able to derive something ...

218d_TPMS_testing_1.txt

[ProfBoc75]

So we can update the comment part with the data layout of the 3 flags.

Continental model: (brand id = 0x80 = 128)

F1: Battery remaining months
F2: 0x01 = static/parked, all values > 0x01 = moving, 0xFF when speed > = 100 kmh
F3: divided into 2 parts, the last 2 bit x x, for sequence number, 1, 2 and 3, the other bit depend on the speed.
    bit position                          1 2 3 4  5 6 7 8
    F3 = 0x05/06/07 low speed (starting), 0 0 0 0  0 1 x x
    F3 = 0x09/0a/0b around 40 kmh,        0 0 0 0  1 0 x x
    F3 = 0x0d/0e/0f > 40 kmh,             0 0 0 0  1 1 x x
    F3 = 0x81/82/83 , stopped,            1 0 0 0  0 0 x x
    F3 = 0xA1/A2/A3 , stopped,            1 0 1 0  0 0 x x
    F3 = 0xC1/C2/C3 , driving + Flag      1 1 0 0  0 0 x x may be an alert like fast deflate / inflate ?
                                            SEQ Number x x = 01 / 10 / 11

[ProfBoc75]

Btw: Are we sure, that the temperature readings are correct?

I saw that also from my street, where temperature could be much less than the air but this could be explained if the car just exit from a garage with a colder temp, depends also if the wheel rim is aluminum or steel, this could help also to dissipate heat ? I can't confirm the temp value as I don't have the sensor at all. Only the tpms display or the diagnostic tool can confirm the temp.

[run-mike]

Only the tpms display or the diagnostic tool can confirm the temp

Unfortunately my car doesn't show the temperatures on the TPMS display; only tire pressures.
But I have posted that question on the F45/F46-forum. Still waiting for a response ...
Meanwhile I exposed the "winter-wheel" to direct sunlight. I will let it bake there for a few hours and then measure temperature of tire, rim, valve and flowing-out air while doing a "fast deflate".
Hopefully that will give me more insight (pun intended ...).

Mike

[run-mike]

Oops!
Accidentally "thumbed up" my own post. How can I undo that?

[ProfBoc75]

😄 just "thumbed up" again, it will toggle off.

[run-mike]

Ok. I found the parameter with the coding software and have now the tire temperatures on the TPMS display.
Will do a test-drive on the Autobahn tomorrow.

Mike

[run-mike]

Due to unforeseeable circumstances I haven't had the opportunity to drive fast in hot weather conditions.
However, that "baking in the sun" for the winter wheel did take place:

• Tire wall temperatue 59°C
• Outer rim temperature 39°C
• Valve temperature 38°C
• Transmitted temperature by sensor 37/38°C

Obviously the tire temperature is not affected by the tire temperature on the outside. Thats where I took the wrong turn.
All good so far. Will do the high temperature check ASAP.

Mike

[zuckschwerdt]

[transmitted] tire temperature is not affected by the tire temperature on the outside.

Thanks! A surprising result. Of course air is a good insulator, but I'd have guessed that tire air and tire rubber equalize to the same temperature.

[run-mike]

Yep. That was my expected outcome too. I was absolutely surprised.
But I still see a margin of error in that "experiment". I would call it a passive warming / heating. The rear side of the tire was not exposed to the sun. And there was no "kneading" of the tire-rubber like when driving fast.
Sadly I was too slow to measure the temperature of the out-flowing air.
If weather forecast is correct, we will have 32°C at the end of the week. Then the "active warming experiment" will happen.
Let's see, what the outcome is then ...

Mike